Findings; Purposes

(a) Findings Congress finds that— (1) the rapid proliferation of high‑wattage IoT devices, such as electric vehicle chargers, clothes dryers, smart air conditioners, water heaters, ovens, and similar appliances, has dramatically increased the number of connected devices in households in the United States; (2) (A) smart appliance applications and software platforms increasingly serve as remote control interfaces; and (B) when those applications and software platforms originate from companies operating under the jurisdiction or direction of foreign adversaries they offer a pathway for large-scale, coordinated manipulation of power demand, threatening grid stability; (3) (A) in certain foreign adversary jurisdictions, particularly the People’s Republic of China, private companies are subject to formal political oversight through mechanisms such as, in the case of the People’s Republic of China, embedded Chinese Communist Party committees and executive-level Chinese Communist Party leadership; and (B) those arrangements blur the lines between commercial activity and state-directed strategic interests; (4) further elevating the risk to the United States electric grid is the 2017 Cybersecurity Law of the People’s Republic of China (commonly referred to as the Chinese Cybersecurity Law), which mandates that Chinese companies store customer data domestically and grant Chinese state authorities broad access to those data; (5) the legal and political structures described in paragraphs (3) and (4) increase the likelihood that connected home appliances could be leveraged by foreign adversaries to target critical infrastructure in the event of a conflict with the United States; (6) companies controlled by foreign adversaries— (A) are actively pursuing rapid deployment of high-wattage IoT devices that could be used to attack the electric grid in the United States; and (B) control more than 25 percent of the major appliance industry in the United States, which provides an established platform for quickly deploying those high-wattage IoT devices; (7) through smart applications, companies controlled by foreign adversaries— (A) are actively collecting detailed consumer data on millions of people in the United States; and (B) have the ability to directly manipulate the demand of high-wattage devices on the electric grid; (8) as a result, foreign adversary-controlled applications for high‑wattage IoT devices create significant risk of coordinated, deliberate, demand-manipulation attacks on the electric grid in the United States; (9) several academic studies from researchers at Princeton University, the Georgia Institute of Technology, and the University of California, Santa Cruz, point to significant risks of manipulation of demand via IoT (commonly referred to as MaDIoT) attacks to manipulate power demand on the electric grid that could result in large-scale blackouts and potential damage to the electric grid; (10) it is therefore critical to protect energy infrastructure in the United States by ensuring that smart applications embedded in home appliances are secure and cannot serve as an entry point for foreign adversaries; and (11) failing to address the vulnerabilities presented by those smart applications could lead to grid instability, frequency imbalances, cascading system failures, and, ultimately, catastrophic disruptions that jeopardize both public safety and the broader economy of the United States. (b) Purposes The purposes of this Act are— (1) to harmonize and reinforce existing national security initiatives aimed at securing the domestic information and communications technology and services (commonly referred to as ICTS) supply chain against manipulation of demand, especially by the People’s Republic of China; and (2) to direct the Secretary of Commerce, in consultation with other relevant Federal officials, to submit to Congress a report containing findings and recommendations to ensure that network-connected home appliances in households in the United States do not serve as a conduit for activities by foreign adversaries or jeopardize the stability of the electric grid in the United States.